OAuth is the way people connect. You point your client at the endpoint, it discovers the server’s OAuth metadata, opens your browser, and you approve the connection with the Studio account you already use. No token to copy, no credential in a config file.
Add the server to your client
See Set up your client for the exact command or config for your harness. All you’re configuring is the URL.
Log in
Adding the server doesn’t authenticate it. Run the login command for your
client — claude mcp login heizen, codex mcp login heizen, /mcp auth heizen — or click Login where the client lists the server.
Approve in the browser
Your browser opens to Studio. Sign in if you aren’t already, then approve the consent screen naming the client that asked.
Back to work
The client stores the token and refreshes it on its own. Run whoami to
confirm you’re connected as the right account.
What you’re approving
An access token acts as you: it reaches every project you can reach in Studio, with the same permissions your account has there. Someone who can’t see a project in Studio can’t see it through MCP either.
| Grant | Authorization code + PKCE (S256 required) |
| Access token | 1 hour |
| Refresh token | 30 days, rotated on every use |
| Scope | a single mcp scope — granular scopes aren’t available yet |
| Client registration | dynamic (RFC 7591), so any compliant client can connect |
Authorization codes are single-use and expire in 60 seconds; replaying one revokes every token from that grant. Refresh tokens are hashed at rest. If you sign out or the refresh window lapses, your client walks you through the same browser approval again.
When there’s nobody to approve
CI jobs, scheduled agents and bots can’t click a consent screen. They use a project-scoped API key instead — see API keys.